commit f45c176d7073c565d53787f2aed61f64a06d824e
author Lei Zhang <thestig@chromium.org> Wed Feb 06 18:50:42 2019 +0000
committer Chromium commit bot <commit-bot@chromium.org> Wed Feb 06 18:50:42 2019 +0000
tree 043b10d820c9c86b7f3a77d15f0b8db9c9d76223
parent fabb0d36022300d2cb396c353599dc8cadce8074

Avoid an integer overflow in CPDF_RenderStatus::ProcessType3Text().

BUG=chromium:917783

Change-Id: I93a103f3be0f430c95963283f3909c1e483fb9c3
Reviewed-on: https://pdfium-review.googlesource.com/c/50070
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

core/fpdfapi/render/cpdf_renderstatus.cpp

diff --git a/core/fpdfapi/render/cpdf_renderstatus.cpp b/core/fpdfapi/render/cpdf_renderstatus.cpp
index 62e8986..1cc304e 100644
--- a/core/fpdfapi/render/cpdf_renderstatus.cpp
+++ b/core/fpdfapi/render/cpdf_renderstatus.cpp
@@ -1863,6 +1863,9 @@
         FX_RECT rect =
             matrix.TransformRect(pType3Char->form()->CalcBoundingBox())
                 .GetOuterRect();
+        if (!rect.Valid())
+          continue;
+
         CFX_DefaultRenderDevice bitmap_device;
         if (!bitmap_device.Create(rect.Width(), rect.Height(), FXDIB_Argb,
                                   nullptr)) {